<?php
/**
*
*	后台帐号管理 @zairwolf
*	2009-4-28 后期考虑权限细分到action 
*/
if(!defined('IN_ACP')) exit('Access Denied');

if(!acppriv()) b('无站长权限');//对用户管理部分双重检测

$selfrow = db_r("select * from rd8_user_acp where user_id='$_G[user_id]'");

//删除用户
if($action=='delete'){
	$pdeladmin=_post('pdeladmin');
	if(empty($pdeladmin)) b('无删除对象');
	foreach($pdeladmin as $val) {
		if($val == $selfrow['id']) b('不能删除自己');
		if($selfrow['adduseracp_id'] && $val == $selfrow['adduseracp_id']) b('不能删除授予自己权限的管理员');
		db_q("delete from rd8_user_acp where id='$val'");
	}
	j("?ptype=$ptype&pfile=$pfile", '管理成功');
}

//添加后台用户
if($action == 'add') {
	$user_name=_post('user_name');
	$name=_post('name');
	$pswd=_post('pswd');
	if(empty($user_name) || empty($name)) b('添加不全');
	//选择前台用户
	if(!$row = db_r("select id,pswd from rd8_user where name='$user_name'")) b('用户不存在');
	//检查后台是否已存在
	if($acprow=db_r("select * from rd8_user_acp where user_id='$row[id]'")) b("后台账号已增加。编号:$acprow[id] 用户名:$acprow[name]");
	//更新后台
	if(!empty($pswd)) {
		$pswd = md5(md5($pswd));
	}else {
		$pswd = $row['pswd'];
	}

	$cols=array(
		'user_id' => $row['id'],
		'user_name' => $user_name,
		'name' => $name,
		'pswd'      => $pswd,
		'privilege' => '',
		'adduser_id'   => $_G['user_id'],
		'adduser_name'   => $_G['user_name'],
		'adduseracp_id'   => $selfrow['id'],
		'adduseracp_name'   => $selfrow['name'],
		'accessip'  => '',
		'history'   => '',
	);
	db_i("insert into rd8_user_acp set ".sqlcol($cols));

	j("?ptype=$ptype&pfile=$pfile", '管理成功');
}

//修改用户更新
if($action == 'update') {
	$padmin=_post('padmin');
	if(empty($padmin['id']) || !ris_int($padmin['id'])) b('非法操作');
	if($selfrow['id'] == $padmin['id']) b('不能编辑自己');
	if($selfrow['adduseracp_id'] && $padmin['id'] == $selfrow['adduseracp_id']) b('不能编辑授予自己权限的管理员');
	if(empty($padmin['name'])) b('用户名不能为空');

	$cols = array();
	$cols['name'] = $padmin['name'];
	if(!empty($padmin['pswd'])) $cols['pswd'] = md5(md5($padmin['pswd']));
	if(!empty($padmin['founder'])) {
		$cols['isfounder'] = 1;
	}else {
		$cols['isfounder'] = 0;
		$privs = array();
		foreach(acpmenu() as $m => $ks) {
			if(empty($padmin['priv'][$m])) continue;
			$privs[] = $m;
			foreach($ks as $k => $fs) {
				if(empty($padmin['priv'][$m][$k])) continue;
				$privs[] = $m.'_'.$k;
				foreach($fs as $p => $f) {
					if(!empty($padmin['priv'][$m][$k][$p])) $privs[] = $m.'_'.$k.'_'.$p;
				}
			}
		}
		$cols['privilege'] = implode(',', $privs);
	}

	if(!empty($padmin['ip'])) $cols['accessip'] = $padmin['ip'];

	db_q("update rd8_user_acp set ".sqlcol($cols)." where id='$padmin[id]'");

	j("?ptype=$ptype&pfile=$pfile", '编辑成功');
}

//修改后台账号
if($action == 'edit') {
	$editadminuser=_get('editadminuser');
	if(empty($editadminuser) || !ris_int($editadminuser)) b('用户不存在');
	if($editadminuser == $selfrow['id']) b('不能编辑自己');
	if($selfrow['adduseracp_id'] && $editadminuser == $selfrow['adduseracp_id']) b('不能编辑授予自己权限的管理员');

	if(!$user = db_r("select * from rd8_user_acp where id='$editadminuser'")) b('用户不存在');
	$priv = explode(',', $user['privilege']);

	$acpprivs = array();
	$acpcatlang=acpcatlang();
	foreach(acpmenu() as $m => $ks) {
		$ksprivs = array();
		$mpriv = false;
		foreach($ks as $k => $fs) {
			if($k == 'shortcut') continue;

			$fsprivs = array();
			$kpriv = false;
			foreach($fs as $p => $f) {
				$fpriv = in_array($m.'_'.$k.'_'.$p, $priv);
				$kpriv = $kpriv || $fpriv;
				$fsprivs[] = array(
					't'       => strip_tags($f),
					'm'       => $m,
					'k'       => $k,
					'f'       => $p,
					'checked' => $fpriv ? ' checked="checked"' : '',
				);
			}
			$mpriv = $mpriv || $kpriv;
			$ksprivs[] = array(
				't'       => strip_tags($acpcatlang[$k]),
				'm'       => $m,
				'k'       => $k,
				'checked' => $kpriv ? ' checked="checked"' : '',
				'fsprivs' => $fsprivs,
			);
		}
		$acpprivs[] = array(
			't'       => strip_tags($acpcatlang[$m]),
			'm'       => $m,
			'checked' => $mpriv ? ' checked="checked"' : '',
			'ksprivs' => $ksprivs,
		);
	}


	$tpl = new T($ptype.'_'.$pfile.'_'.$action);
	$tpl->assign(array(
		'acpprivs'  => $acpprivs,
		'C_checked' => $user['isfounder'] ? ' checked="checked"' : '',
		'C_name'    => $user['name'],
		'C_ip'      => $user['accessip'],
		'C_id'      => $user['id'],
	));
	$tpl->output();
}

//默认显示
if(!$action){
	$list=db_rows("select * from rd8_user_acp");
	$tpl = new T($ptype.'_'.$pfile);
	$tpl->assign('list', $list);
	$tpl->output();
}

